Description
SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
Published: 2026-10-21
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Information Disclosure via Path Traversal
Action: Patch Immediately
AI Analysis

Impact

SvelteKit versions up to but not including 3.0.0 contain a path traversal flaw in the vite preview server on Windows that allows an unauthenticated attacker to read files outside the prerendered output directory. An attacker can craft requests that resolve to arbitrary filesystem paths, exposing source code, configuration files, or credentials that the preview process can read.

Affected Systems

The vulnerability affects SvelteKit, the framework maintained by sveltejs:kit. All releases from 2.10.0 up to any version before 3.0.0 are vulnerable; the exact patch will appear in 3.0.0 and later releases.

Risk and Exploitability

The CVSS score of 8.7 classifies the issue as high severity while the EPSS score of less than 1% indicates a low probability of exploitation at the moment. The flaw is not listed in the CISA KEV catalog. An attacker requires network reach to the vite preview server running on Windows, and no authentication is needed to trigger the path traversal. Once reachable, a crafted HTTP request can retrieve arbitrary files within the server’s filesystem that are readable by the preview process.

Generated by OpenCVE AI on October 21, 2026 at 15:02 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade SvelteKit to version 3.0.0 or later to remove the path traversal flaw.
  • If an upgrade cannot be performed immediately, restrict external access to the vite preview server by firewalling the port or ensuring it listens only on localhost.
  • Consider adding an authentication layer or IP whitelist to the preview server to prevent unauthenticated access until the patch is deployed.

Generated by OpenCVE AI on October 21, 2026 at 15:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 23:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 21 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server on Windows that allows unauthenticated attackers to read files outside the prerendered output directory. Attackers who can reach the preview server through network access or a tunnel can send crafted requests to expose source code, configuration, or credentials readable by the server process.
Title SvelteKit 2.10.0 before 3.0.0 Path Traversal via vite preview on Windows
First Time appeared Svelte
Svelte kit
Weaknesses CWE-22
CPEs cpe:2.3:a:svelte:kit:*:*:*:*:*:*:*:*
Vendors & Products Svelte
Svelte kit
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

Svelte Kit
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-27T21:43:53.677Z

Reserved: 2026-10-20T21:43:23.218Z

Link: CVE-2026-114063

cve-icon Vulnrichment

Updated: 2026-10-27T21:43:49.379Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-21T01:17:29.600

Modified: 2026-10-27T22:17:24.213

Link: CVE-2026-114063

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T10:42:09Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')